@crediolabs/policy-builder-mcp 0.4.0 → 0.5.0

package/dist/src/schemas.d.ts

@@ -848,6 +848,22 @@ export declare const DeclarePolicyToolShape: {
     readonly recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     readonly recipientArgIndex: z.ZodOptional<z.ZodNumber>;
     readonly allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+    readonly minOutputRatio: z.ZodOptional<z.ZodObject<{
+        num: z.ZodString;
+        den: z.ZodString;
+        inputArgIndex: z.ZodNumber;
+        outputArgIndex: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }>>;
 };
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union

package/dist/src/schemas.js

@@ -98,6 +98,14 @@ export const DeclarePolicyToolShape = {
     recipients: z.array(z.string()).optional(),
     recipientArgIndex: z.number().int().nonnegative().optional(),
     allowZeroCap: z.boolean().optional(),
+    minOutputRatio: z
+        .object({
+        num: z.string(),
+        den: z.string(),
+        inputArgIndex: z.number().int().nonnegative(),
+        outputArgIndex: z.number().int().nonnegative(),
+    })
+        .optional(),
 };
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union

package/dist/src/server.js

@@ -32,8 +32,8 @@ export function registerTools(server) {
     server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', SynthesizePolicyToolShape, (args) => runSynthesizePolicy(args).then(toCallToolResult));
     server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', SimulatePolicyToolShape, (args) => toCallToolResult(runSimulatePolicy(args)));
     server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', VerifyPolicyToolShape, (args) => toCallToolResult(runVerifyPolicy(args)));
-    server.tool('declare_policy', 'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.', DeclarePolicyToolShape, (args) => Promise.resolve(runDeclarePolicy(args)).then(toCallToolResult));
-    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', InstallPolicyToolShape, (args) => runInstallPolicy(args).then(toCallToolResult));
+    server.tool('declare_policy', "Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap, a recipient allowlist, and a minimum-output ratio (a swap slippage floor, bounding the output argument against the call's own input). Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 4, and both belong to the OpenZeppelin account layer.", DeclarePolicyToolShape, (args) => Promise.resolve(runDeclarePolicy(args)).then(toCallToolResult));
+    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The response carries an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. The account is READ over RPC to build it; pass `existingRules` to supply them yourself instead (useful offline). `authorityScan: null` means NOT CHECKED - the read failed, or it could not account for every live rule - and must never be read as "nothing found". The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', InstallPolicyToolShape, (args) => runInstallPolicy(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', RevokePolicyToolShape, (args) => runRevokePolicy(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', GetInterpreterInfoToolShape, (args) => runGetInterpreterInfo(args).then(toCallToolResult));
 }

package/dist-cjs/src/schemas.d.ts

@@ -848,6 +848,22 @@ export declare const DeclarePolicyToolShape: {
     readonly recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     readonly recipientArgIndex: z.ZodOptional<z.ZodNumber>;
     readonly allowZeroCap: z.ZodOptional<z.ZodBoolean>;
+    readonly minOutputRatio: z.ZodOptional<z.ZodObject<{
+        num: z.ZodString;
+        den: z.ZodString;
+        inputArgIndex: z.ZodNumber;
+        outputArgIndex: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }, {
+        num: string;
+        den: string;
+        inputArgIndex: number;
+        outputArgIndex: number;
+    }>>;
 };
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union

package/dist-cjs/src/schemas.js

@@ -106,6 +106,14 @@ exports.DeclarePolicyToolShape = {
     recipients: zod_1.z.array(zod_1.z.string()).optional(),
     recipientArgIndex: zod_1.z.number().int().nonnegative().optional(),
     allowZeroCap: zod_1.z.boolean().optional(),
+    minOutputRatio: zod_1.z
+        .object({
+        num: zod_1.z.string(),
+        den: zod_1.z.string(),
+        inputArgIndex: zod_1.z.number().int().nonnegative(),
+        outputArgIndex: zod_1.z.number().int().nonnegative(),
+    })
+        .optional(),
 };
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`
  *  at the tool boundary because the rule schema is a discriminated union

package/dist-cjs/src/server.js

@@ -36,8 +36,8 @@ function registerTools(server) {
     server.tool('synthesize_policy', 'Synthesize a ProposedPolicy from a RecordedTransaction (`source: recording`).', schemas_ts_1.SynthesizePolicyToolShape, (args) => (0, run_1.runSynthesizePolicy)(args).then(toCallToolResult));
     server.tool('simulate_policy', 'Evaluate a predicate against one recorded call and report permit/deny with the deny reason. The evaluator is a second implementation of the on-chain semantics, cross-checked against the Rust interpreter by the conformance harness, so a verdict here is a claim about what the contract would do. Pass the `predicate` returned by `synthesize_policy` under `explain`.', schemas_ts_1.SimulatePolicyToolShape, (args) => toCallToolResult((0, run_1.runSimulatePolicy)(args)));
     server.tool('verify_policy', 'Check a predicate against the transaction it was synthesised from, plus a generated deny case per dimension. Reports `ok` only when the permit case is permitted AND every deny case is denied - a denied permit case means the policy is too strict, a permitted deny case means it is too loose.', schemas_ts_1.VerifyPolicyToolShape, (args) => toCallToolResult((0, run_1.runVerifyPolicy)(args)));
-    server.tool('declare_policy', 'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.', schemas_ts_1.DeclarePolicyToolShape, (args) => Promise.resolve((0, run_1.runDeclarePolicy)(args)).then(toCallToolResult));
-    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
+    server.tool('declare_policy', "Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap, a recipient allowlist, and a minimum-output ratio (a swap slippage floor, bounding the output argument against the call's own input). Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 4, and both belong to the OpenZeppelin account layer.", schemas_ts_1.DeclarePolicyToolShape, (args) => Promise.resolve((0, run_1.runDeclarePolicy)(args)).then(toCallToolResult));
+    server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The response carries an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. The account is READ over RPC to build it; pass `existingRules` to supply them yourself instead (useful offline). `authorityScan: null` means NOT CHECKED - the read failed, or it could not account for every live rule - and must never be read as "nothing found". The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', schemas_ts_1.InstallPolicyToolShape, (args) => (0, run_1.runInstallPolicy)(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', schemas_ts_1.RevokePolicyToolShape, (args) => (0, run_1.runRevokePolicy)(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', schemas_ts_1.GetInterpreterInfoToolShape, (args) => (0, run_1.runGetInterpreterInfo)(args).then(toCallToolResult));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "MIT",
   "description": "MCP server exposing the OZ policy-synth core (record_transaction + synthesize_policy) over stdio and Streamable HTTP transports.",
   "type": "module",
@@ -63,7 +63,7 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.4.0",
+    "@crediolabs/policy-synth": "0.5.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"

package/src/schemas.ts

@@ -138,6 +138,14 @@ export const DeclarePolicyToolShape = {
   recipients: z.array(z.string()).optional(),
   recipientArgIndex: z.number().int().nonnegative().optional(),
   allowZeroCap: z.boolean().optional(),
+  minOutputRatio: z
+    .object({
+      num: z.string(),
+      den: z.string(),
+      inputArgIndex: z.number().int().nonnegative(),
+      outputArgIndex: z.number().int().nonnegative(),
+    })
+    .optional(),
 } as const
 
 /** Flat ZodRawShape for `install_policy`. `rule` is typed as `z.unknown()`

package/src/server.ts

@@ -87,14 +87,14 @@ export function registerTools(server: McpServer): void {
 
   server.tool(
     'declare_policy',
-    'Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap and a recipient allowlist. Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 3.',
+    "Build an interpreter predicate from a DECLARED constraint - the method to pin, and optionally the contract, a per-call amount cap, a recipient allowlist, and a minimum-output ratio (a swap slippage floor, bounding the output argument against the call's own input). Use this when there is no transaction to record, or when `record_transaction` refuses a contract it does not recognise. Returns the predicate tree, its canonical encoding and hash, ready for `install_policy`. `warnings` names any argument index that was GUESSED rather than supplied - a bound on the wrong argument constrains nothing while looking correct, so read them. There is no rolling spend window and no approval threshold: neither is expressible in grammar 4, and both belong to the OpenZeppelin account layer.",
     DeclarePolicyToolShape,
     (args) => Promise.resolve(runDeclarePolicy(args)).then(toCallToolResult)
   )
 
   server.tool(
     'install_policy',
-    'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. Pass `existingRules` to get an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. Omitting them returns `authorityScan: null`, meaning NOT CHECKED. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.',
+    'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The response carries an `authorityScan`: every rule already on the account that a signer of this install could name INSTEAD, including an unpoliced one against which the predicate never runs - a predicate only constrains a key when the policed rule is the only rule that key is on. The account is READ over RPC to build it; pass `existingRules` to supply them yourself instead (useful offline). `authorityScan: null` means NOT CHECKED - the read failed, or it could not account for every live rule - and must never be read as "nothing found". The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.',
     InstallPolicyToolShape,
     (args) => runInstallPolicy(args).then(toCallToolResult)
   )